Security audit

Skill Publish To Market

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real publishing workflow, but it asks for powerful credentials and automates external uploads and repository changes with weak scoping and unsafe command-template handling.

Install only if you trust the skill directories you will publish and are comfortable with the agent uploading those files to ClawHub and GitHub-backed registries. Use the narrowest possible token, avoid broad classic GitHub PATs when a fine-grained token works, revoke tokens after use, review the exact file list and target platforms before publishing, and avoid publishing untrusted skill packages until the shell/JSON template escaping is fixed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Note

Location: SKILL.md:329
Finding: Mandatory Branded Output Overrides User-Facing Response Content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/templates.md:77
Finding: Unescaped Metadata and Paths Are Interpolated into Shell and JSON Templates
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:57
Finding: Publishing Workflow Requires an Overprivileged GitHub Personal Access Token
Content: View full analysis
**Security:** Tokens are used for the current session only. NEVER log, store, or display full tokens. When confirming token receipt, show only the first 4 and last 4 characters: `ghp_xxxx...xxxx`. NEVER include tokens in output, reports, or error messages. | Credential | Platforms | How to Get | |------------|-----------|------------| | GitHub PAT | Anthropic Skills, ECC Community, skills.sh | github.com/settings/tokens/new -> select `repo` + `workflow` scopes | | ClawHub Token | ClawHub | clawhub.ai -> Settings -> API Tokens -> Create Token (starts with `clh_`) | **Credential tutorial (show when user doesn't know how to get tokens):** ### GitHub PAT: 1. Open https://github.com/settings/tokens/new 2. Note: "Skill Publisher" 3. Expiration: 90 days (recommended) 4. Select scopes: `repo` (full) + `workflow` 5. Click "Generate token" -> copy immediately (shown only once) ``` ### Technical Analysis The workflow directs users to create a classic GitHub PAT with full `repo` and `workflow` scopes. These permissions are broader than the described operation of forking public repositories, uploading Skill files to the user's fork, and opening pull requests. In particular: - The classic `repo` scope can grant broad access to private repositories available to the user. - The `workflow` scope permits modification of GitHub Actions workflow files. - The token is then placed in the authorization header of numerous commands executed by an agent-driven shell workflow. The project includes guidance not to log or persist tokens, which reduces accidental exposure, but it does not reduce the token's authority. The unsafe interpolation issue in the command te ...[truncated 1287 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (32)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 54)May include surrounding context.
md
## Token 获取教程 ### GitHub Personal Access Token (PAT) GitHub PAT 用于向 Anthropic Skills、ECC Community、skills.sh 三个平台提交 PR 或上传文件。

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 181)May include surrounding context.
md
## Token 获取教程 ### GitHub Personal Access Token (PAT) GitHub PAT 用于向 Anthropic Skills、ECC Community、skills.sh 三个平台提交 PR 或上传文件。

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: The skill explicitly solicits high-privilege credentials, including a GitHub PAT with broad repo and workflow scopes, and a ClawHub token. Even if operationally needed, collecting such secrets inside a broadly-triggerable skill creates a substantial risk: accidental invocation, mishandling by the agent, token leakage in logs/process lists, or misuse to create arbitrary repository changes and workflow abuse.
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
md
|-----------|----------|-------------| | `skill_path` | Yes | Path to the skill directory (must contain SKILL.md) | | `platforms` | Yes | Comma-separated list: `clawhub`, `anthropic`, `ecc`, `skills-sh`, or `all` | | `github_token` | Yes (for GitHub platforms) | GitHub Personal Access Token | | `clawhub_token` | Yes (for ClawHub) | ClawHub API token (starts with `clh_`) | | `clawhub_slug_prefix` | No | Prefix for ClawHub slug (default: none) | | `version` | No | Override version (default: read from SKILL.md frontmatter) |

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.
Agent: Re-runs Anthropic Skills publish step with existing credentials

text
## Output Rules 1. Always show the Quality Gate results before publishing 2. Always show the results table after publishing

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/fallbacks.md (reported line 39)May include surrounding context.
md
## Case 2: GitHub Token Missing Scopes **Detection:** Fork or file upload returns 403 "Resource not accessible by personal access token" **Message:** "Your GitHub token doesn't have the required scopes. It needs `repo` and `workflow`. Please regenerate at https://github.com/settings/tokens/new." **Recovery:** Ask user to regenerate with correct scopes.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README instructs users to obtain high-privilege GitHub and ClawHub tokens and states that the agent will automatically perform API calls and create PRs, but it does not prominently warn that these credentials are sensitive or that the skill will make external, potentially irreversible remote changes. In an agent context, this increases the risk of users handing over broad credentials without informed consent and of accidental publication to third-party services.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 32)May include surrounding context.
md
**ClawHub Token:** 1. 打开 https://clawhub.ai 并登录 2. 进入 Settings -> API Tokens 3. 点击 "Create Token"，命名为 "skill-publish" 4. 复制 Token（以 `clh_` 开头） ### 第 2 步：安装技能

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 32)May include surrounding context.
md
**ClawHub Token:** 1. 打开 https://clawhub.ai 并登录 2. 进入 Settings -> API Tokens 3. 点击 "Create Token",命名为 "skill-publish" 4. 复制 Token(以 `clh_` 开头) ### 第 2 步:安装技能

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The bulk publishing example encourages wide-reaching automated publication across multiple platforms without warning about the scale of remote changes, rate limits, accidental disclosure, or mass submission mistakes. In this skill's context, bulk mode amplifies the blast radius because a single command could push many skills to several external repositories and APIs.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 159)May include surrounding context.
md
**ClawHub Token:** 1. Go to https://clawhub.ai -> Settings -> API Tokens 2. Click "Create Token", name it "skill-publish" 3. Copy the token (starts with `clh_`) ### Step 2: Install the Skill

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description emphasizes convenience but does not clearly disclose that execution will create external pull requests, upload content to third-party services, and use user-provided tokens. That omission can mislead users about the consequence of activation, increasing the chance of accidental remote changes and secret disclosure into a workflow they did not intend to start.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The English activation phrases are broad enough to match common user intents such as 'upload skill', 'submit PR', or 'deploy skill', which can cause the agent to invoke a high-impact publishing workflow unexpectedly. Because this skill performs remote actions across external platforms, overbroad triggers materially increase the risk of unintended credential collection and unintended repository or marketplace changes.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/fallbacks.md (reported line 10)May include surrounding context.
md
**Recovery by tool:** - `curl` missing: - macOS: `brew install curl` - Ubuntu: `sudo apt install curl` - Alpine: `apk add curl` - `base64` missing: - Ubuntu: `sudo apt install coreutils`

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/fallbacks.md (reported line 13)May include surrounding context.
md
**Recovery by tool:** - `curl` missing: - macOS: `brew install curl` - Ubuntu: `sudo apt install curl` - Alpine: `apk add curl` - `base64` missing: - Ubuntu: `sudo apt install coreutils`

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/fallbacks.md (reported line 16)May include surrounding context.
md
**Recovery by tool:** - `curl` missing: - macOS: `brew install curl` - Ubuntu: `sudo apt install curl` - Alpine: `apk add curl` - `base64` missing: - Ubuntu: `sudo apt install coreutils`

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The playbook instructs collection of GitHub and ClawHub tokens and immediate authenticated publishing actions, but does not require a clear user-facing warning that secrets will be transmitted to third-party services and that actions can create forks, branches, uploads, PRs, and live publications. This weakens informed consent and increases the chance of users providing high-privilege credentials without understanding the external side effects.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file states tokens are never stored for the current session, but later relies on prior publish-session records from an execution log to support status checking. That inconsistency creates a risk that sensitive publish metadata, and potentially credentials or credential-adjacent data, are retained longer than users were told, undermining data-minimization and trust assumptions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This endpoint call transmits a bearer token to an external service for verification. Although token verification is expected functionality, it is still an external transmission of sensitive credentials and becomes risky if performed without clear disclosure, scope minimization, and secure token handling in the calling skill.
Content: Scanner excerpt · references/templates.md (reported line 7)May include surrounding context.
Verify Token

bash
curl -s \ -H "Authorization: Bearer {TOKEN}" \ -H "Accept: application/json" \ https://clawhub.ai/api/v1/whoami

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The template explicitly uploads local skill files (SKILL.md and multiple references/*.md files) to an external service, but the surrounding instructions do not require a clear user-facing consent or warning before transmission. This is dangerous because skill content may contain proprietary prompts, internal procedures, secrets, or sensitive metadata that would be exfiltrated to a third party if the skill is run automatically.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This request sends a GitHub bearer token to api.github.com to identify the user. While normal for GitHub integrations, it is still a credential transmission to an external service and should be treated as sensitive, especially in automated agent workflows where users may not realize network access is occurring.
Content: Scanner excerpt · references/templates.md (reported line 43)May include surrounding context.
curl -s
-H "Authorization: Bearer {TOKEN}"
-H "Accept: application/vnd.github+json"
https://api.github.com/user

text
Expected: `{"login":"username",...}`

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: These GitHub templates automate forking, branch creation, file upload, and pull request creation, which sends local skill files and repository content to GitHub without an embedded requirement for informed user consent. In an agent setting, this can cause unintended publication of private or sensitive material and creates durable public artifacts such as forks and PRs.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: Fork creation is an external state-changing action on GitHub, initiated with a bearer token. In context, this is more dangerous than a read-only API call because it can create persistent remote artifacts and may expose intent, metadata, or content flow to a third-party platform without adequate warning.
Content: Scanner excerpt · references/templates.md (reported line 52)May include surrounding context.
curl -s -X POST
-H "Authorization: Bearer {TOKEN}"
-H "Accept: application/vnd.github+json"
https://api.github.com/repos/{OWNER}/{REPO}/forks
-d '{}'

text
Wait 3 seconds after forking.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
curl -s
-H "Authorization: Bearer {TOKEN}"
-H "Accept: application/vnd.github+json"
https://api.github.com/repos/{USERNAME}/{REPO}/git/ref/heads/{DEFAULT_BRANCH}

text
Extract: `.object.sha`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/fallbacks.md (reported line 215)May include surrounding context.
curl -s
-H "Authorization: Bearer {TOKEN}"
-H "Accept: application/vnd.github+json"
https://api.github.com/repos/{USERNAME}/{REPO}/git/ref/heads/{DEFAULT_BRANCH}

text
Extract: `.object.sha`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/playbooks.md (reported line 201)May include surrounding context.
curl -s
-H "Authorization: Bearer {TOKEN}"
-H "Accept: application/vnd.github+json"
https://api.github.com/repos/{USERNAME}/{REPO}/git/ref/heads/{DEFAULT_BRANCH}

text
Extract: `.object.sha`

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

Credential Access

Credential Access

Credential Access

Direct Prompt Extraction

Credential Access

Missing User Warnings

Session Persistence

Session Persistence

Missing User Warnings

Session Persistence

Missing User Warnings

Vague Triggers

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Missing User Warnings

Intent-Code Divergence

External Transmission

Verify Token

Missing User Warnings

External Transmission

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

Static analysis